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CLAIMS 

1 • A content scanning system for electronic documents such as emails 

comprising: 

a) a link analyser for identifying hyperlinks in document content; 

5 b) means for causing a content scanner to scan objects referenced by 

links identified by the link analyser and to determine their acceptability according to . 
predefined rules, the means being operative, when the link is to an object external to the 
document and is determined by the content analyser to be acceptable, to retrieve the 
external object and modify the document by replacing the link to the external object by one 
10 to a copy of the object stored on a trusted server. 

2. A system according to claim 1 wherein the link analyser a) and means b) are 
operative to recursively process links identified in such external objects. 

3. A system according to claim 2 in which only a maximum depth of recursion 
is permitted and the document is flagged as unacceptable if that limit is reached. 

15 4. A system according to any one of the preceding claims wherein if any 

linked-to object is determined by the content scanner to be unacceptable the document is 
flagged or modified to indicate that fact. 

5. A method of content-scanning electronic documents such as emails 

comprising: 

20 a) using a link analyser for identifying hyperlinks in document content; 

b) using a content scanner to scan objects referenced by links identified 
by the link analyser and to determine their acceptability according to predefined rules, the 
means being operative, when the link is to an object external to the document and is 
determined by the content analyser to be acceptable, to retrieve the external object and 

25 modify the document by replacing the link to the external object by one to a copy of the 
object stored on a trusted server. 
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6- A method according to claim 5 wherein the steps a) and b) are used 
recursively to process links identified in such external objects. 

7 - A method according to claim 6 in which only a maximum depth of recursion 
is permitted and the document is flagged as unacceptable if that limit is reached. 
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8. A method according to any one of claim 5 to 7, wherein if any linked-to 

object is determined by the content scanner to be unacceptable the document is flagged or 
modified to indicate that fact. 



